NeoMetal, an online retailer within the Body Art Alliance family of brands, has notified the New Hampshire Attorney General of a payment card incident on its online store. The company says 101 people were affected and that card numbers and security codes may have been captured. Retailers must protect the payment information shoppers entrust to them.
NeoMetal’s Data Breach Investigation
NeoMetal, Inc. operates an online store. In its notice to regulators it describes itself as an affiliate of Body Art Alliance, LLC and a subsidiary of Artifex Distribution Acquisition Corporation. Body Art Alliance operates a family of related brands, and the store notice says shoppers at each brand may be told about the incident under that brand’s own name.
The notice was sent to the New Hampshire Attorney General by the company’s general counsel by email on October 19, 2026. It reports that the incident happened on October 14, 2026, between 6:06 a.m. and 12:32 p.m. Eastern Time, and that the company discovered it on October 16, 2026, when its vendor told it what had happened.
The company explains the mechanism in plain terms. An unauthorized party changed the settings of a third-party Shopify application called Wishlist Plus, which is provided by a vendor named Swym Corporation and was installed on NeoMetal’s online store. The altered app loaded a malicious script. Shoppers who clicked Checkout could be sent to a fraudulent payment page, which captured their card details, name and billing address, and then passed them along to the genuine Shopify checkout so that nothing looked wrong.
That detail matters because the shopper experience would have looked normal. A person would have clicked Checkout, entered payment information, and finished the order without any sign that a copy of the card number had gone to someone else. The company says Shopify’s checkout and its own internal systems were not breached. In its account, the weak point was a plug-in running inside the store, not the payment platform.
According to the notice, the total number of affected individuals is 101, and one of them is a New Hampshire resident. The information involved is name, billing address, payment card number, expiration date and security code. The company states that no Social Security numbers, driver’s license numbers or account passwords were involved. The sample notice sent to shoppers also says that email address and phone number may have been captured.
The sample notice to shoppers gives an important distinction. People who used an express payment button such as Shop Pay, Apple Pay, Google Pay or PayPal directly from a product or cart page, without first clicking Checkout, did not have their card details exposed. People who clicked Checkout and then paid by any method may have had their details captured on the fake page before reaching the real checkout.
The company says the vendor removed the malicious script and closed the access path, and that Shopify removed the app from its App Store. NeoMetal says it is scanning its storefronts, reviewing every third-party script on its stores and putting checkout monitoring in place. It says it is working with the vendor and its payment processor and is notifying regulators where required. The affected resident was to receive notice by email on October 19, 2026.
Compromises of this kind are sometimes called web skimming or Magecart-style attacks. They target the checkout page rather than a company’s database, and they often rely on a trusted third-party script or app that the retailer does not fully control. This is general industry context and the notice does not use those labels. The notice does not say how the unauthorized party gained access to the app’s configuration.
Because card numbers, expiration dates and security codes together are everything a thief needs to make online purchases, the most useful step is usually to contact the card issuer. A new card number ends the risk from that stolen data, while credit freezes matter less because no Social Security number was reported. Anyone who shopped on a Body Art Alliance brand site on October 14, 2026 should check statements closely, since the notice covers only the people the company identified from its records.
When Did This Breach Occur?
The company reports that the incident occurred on October 14, 2026, between 6:06 a.m. and 12:32 p.m. Eastern Time. It discovered the incident on October 16, 2026, when its vendor notified it. Notice to affected shoppers was planned by email on October 19, 2026.
What Information Was Breached?
According to the notice, the information involved is name, billing address, payment card number, expiration date and security code.
The company says no Social Security numbers, driver’s license numbers or account passwords were involved.
What You Can Do
If you received a notice related to NeoMetal or believe you may be affected, consider these steps:
- Read the notice carefully and keep it, along with any enrollment details for protection services it offers.
- Call the bank that issued your card, tell them it may have been compromised, and ask for a replacement card number. This is the most important step.
- Place a free fraud alert or a credit freeze with Equifax, Experian and TransUnion, and get your reports free at annualcreditreport.com.
- Review bank, card and insurance statements for anything you do not recognize.
- Be skeptical of unexpected calls, texts or emails that mention the incident, and report suspected identity theft to the Federal Trade Commission at identitytheft.gov.
File a Data Breach Lawsuit Against NeoMetal
If you were notified that your payment card information was captured in the incident involving NeoMetal, you may have legal options. Retailers are expected to safeguard the payment information of their customers, including when a third-party app runs on their store, and a class action can help hold them accountable when they fall short.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
